Microsoft Edge (Chromium-Based) Multiple Vulnerabilities - Jun24

Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-8J42-PCFM-3467 SQL injection in litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

SQL injection in litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

PT-2024-26480 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A stack overflow issue was discovered via the desc parameter in the SetPortForwardRules function. This allows for potential exploitation. Recommendations: For TOTOLINK CP900L version...

PT-2024-26476 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A hardcoded password issue was found in the /etc/shadow.sample file, allowing attackers to log in as root. Recommendations: For TOTOLINK CP900L version 4.1.5cu.798 B20221228, consider...

PT-2024-31215 · WordPress · The 140+ Widgets

Name of the Vulnerable Software and Affected Versions: The 140+ Widgets | Best Addons For Elementor – FREE for WordPress versions up to, and including, 1.4.3.1 Description: The issue allows authenticated attackers with contributor-level permissions and above to inject a PHP Object via...

VMware Workstation Multiple Vulnerabilities (VMSA_2024_0010) - Windows

VMware Workstation is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vmware:workstation";...

PT-2024-3879 · Automationdirect · Automationdirect P3-550E

Name of the Vulnerable Software and Affected Versions: AutomationDirect P3-550E version 1.2.10.9 Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality. Specially crafted network packets can lead to heap-based memory...

PT-2024-26544 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/ca deal.php" with parameters mudi and nohrefStr. This allows for unauthorized requests. Recommendations: For idccms version 1.35,...

PT-2024-26553 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is related to a stack overflow that can occur via the iptv.stb.port parameter in the formSetIptv function. Recommendations: For Tenda AX1806 version 1.0.0.1, avoid using the iptv.stb.port...

CVE-2024-25595

Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1...

PT-2024-24630 · Weforms · Weforms

Name of the Vulnerable Software and Affected Versions: weForms versions 1.6.20 and earlier Description: The issue is related to a Client-Side Enforcement of Server-Side Security vulnerability in weForms, which allows the removal of important client functionality. Recommendations: For weForms...

PT-2024-13020 · Unknown · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress versions through 4.13.1 Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in ProfilePress Membership Team ProfilePress. Recommendations: For versions through 4.13.1, update to a...

PT-2024-13378 · Unknown · Ics Calendar

Name of the Vulnerable Software and Affected Versions: ICS Calendar versions n/a through 10.12.0.3 Description: The issue affects ICS Calendar, allowing Absolute Path Traversal and Server Side Request Forgery due to improper limitation of a pathname to a restricted directory. This enables an...

PT-2024-13470 · Wedevs · Wedevs Wp User Frontend

Name of the Vulnerable Software and Affected Versions: weDevs WP User Frontend versions 3.6.5 and earlier Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in weDevs WP User Frontend. Recommendations: For versions 3.6.5 and earlier, update to a...

F5 Networks BIG-IP : BIG-IP HTTP non-RFC-compliant security exposure (K11342432)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.5.1 / 15.1.7 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K11342432 advisory. This issue occurs when a non-RFC-compliant HTTP request is received by a virtual server on a syste...

PT-2024-28619

Name of the Vulnerable Software and Affected Versions OpenText iManager version 3.2.6.0200 Description A remote code execution issue has been discovered, allowing for the execution of remote code through a custom file upload task. Recommendations For OpenText iManager version 3.2.6.0200, consider...

CVE-2024-35166

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3...

PT-2024-5184 · Adobe · Animate

Name of the Vulnerable Software and Affected Versions: Adobe Animate versions 24.0.2, 23.0.5 and earlier Description: The issue is related to a heap-based buffer overflow in dynamic memory, which could allow an attacker to execute arbitrary code using a specially crafted file. Exploitation of thi...

PT-2024-3804 · Cacti +3 · Cacti +3

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.27 Description: The issue is related to the form save function in Cacti, which lacks proper validation of XML object sequences, allowing a remote attacker to execute arbitrary SQL queries. This is due to some data...